Implemented computation of export hashes

include/retdec/fileformat/file_format/file_format.h

@@ -116,6 +116,7 @@ class FileFormat : public retdec::utils::ByteValueStorage, private retdec::utils
 		void loadStrings(StringType type, std::size_t charSize);
 		void loadStrings(StringType type, std::size_t charSize, const SecSeg* secSeg);
 		void loadImpHash();
+		void loadExpHash();
 		bool isInValidState() const;
 		LoadFlags getLoadFlags() const;
 		/// @}

include/retdec/fileformat/types/export_table/export.h

@@ -42,6 +42,7 @@ class Export
 
 		/// @name Other methods
 		/// @{
+		virtual bool isUsedForExphash() const;
 		void invalidateOrdinalNumber();
 		bool hasEmptyName() const;
 		/// @}

include/retdec/fileformat/types/export_table/export_table.h

@@ -21,14 +21,20 @@ class ExportTable
 {
 	private:
 		using exportsIterator = std::vector<Export>::const_iterator;
-		std::vector<Export> exports; ///< stored exports
+		std::vector<Export> exports;				///< stored exports
+		std::string expHashCrc32;					///< exphash CRC32
+		std::string expHashMd5;						///< exphash MD5
+		std::string expHashSha256;					///< exphash SHA256
 	public:
 		ExportTable();
 		~ExportTable();
 
 		/// @name Getters
 		/// @{
 		std::size_t getNumberOfExports() const;
+		const std::string& getExphashCrc32() const;
+		const std::string& getExphashMd5() const;
+		const std::string& getExphashSha256() const;
 		const Export* getExport(std::size_t exportIndex) const;
 		const Export* getExport(const std::string &name) const;
 		const Export* getExportOnAddress(unsigned long long address) const;
@@ -42,6 +48,7 @@ class ExportTable
 
 		/// @name Other methods
 		/// @{
+		void computeHashes();
 		void clear();
 		void addExport(Export &newExport);
 		bool hasExports() const;

include/retdec/fileformat/types/import_table/import_table.h

@@ -24,7 +24,6 @@ class ImportTable
 		using importsIterator = std::vector<std::unique_ptr<Import>>::const_iterator;
 		std::vector<std::string> libraries;           ///< name of libraries
 		std::vector<std::unique_ptr<Import>> imports; ///< stored imports
-		std::vector<unsigned char> impHashBytes;      ///< bytes for calculation of imphash
 		std::string impHashCrc32;                     ///< imphash CRC32
 		std::string impHashMd5;                       ///< imphash MD5
 		std::string impHashSha256;                    ///< imphash SHA256
@@ -39,9 +38,9 @@ class ImportTable
 		std::size_t getNumberOfImportsInLibrary(std::size_t libraryIndex) const;
 		std::size_t getNumberOfImportsInLibrary(const std::string &name) const;
 		std::size_t getNumberOfImportsInLibraryCaseInsensitive(const std::string &name) const;
-		std::string getImphashCrc32() const;
-		std::string getImphashMd5() const;
-		std::string getImphashSha256() const;
+		const std::string& getImphashCrc32() const;
+		const std::string& getImphashMd5() const;
+		const std::string& getImphashSha256() const;
 		std::string getLibrary(std::size_t libraryIndex) const;
 		const Import* getImport(std::size_t importIndex) const;
 		const Import* getImport(const std::string &name) const;

src/fileformat/file_format/file_format.cpp

@@ -459,6 +459,19 @@ void FileFormat::loadImpHash()
 	importTable->computeHashes();
 }
 
+/**
+ * Loads exphash from export table.
+ */
+void FileFormat::loadExpHash()
+{
+	if (!exportTable || (loadFlags & LoadFlags::NO_VERBOSE_HASHES))
+	{
+		return;
+	}
+
+	exportTable->computeHashes();
+}
+
 /**
  * Getter for state of instance
  * @return @c true if all is OK, @c false otherwise

src/fileformat/file_format/pe/pe_format.cpp

@@ -707,7 +707,7 @@ void PeFormat::loadImports()
 
 	loadImpHash();
 
-	for (auto&& addressRange : formatParser->getImportDirectoryOccupiedAddresses())
+	for(auto&& addressRange : formatParser->getImportDirectoryOccupiedAddresses())
 	{
 		nonDecodableRanges.addRange(std::move(addressRange));
 	}
@@ -733,7 +733,9 @@ void PeFormat::loadExports()
 		exportTable->addExport(newExport);
 	}
 
-	for (auto&& addressRange : formatParser->getExportDirectoryOccupiedAddresses())
+	loadExpHash();
+
+	for(auto&& addressRange : formatParser->getExportDirectoryOccupiedAddresses())
 	{
 		nonDecodableRanges.addRange(std::move(addressRange));
 	}

src/fileformat/types/export_table/export.cpp

@@ -88,6 +88,16 @@ void Export::setOrdinalNumber(unsigned long long exportOrdinalNumber)
 	ordinalNumberIsValid = true;
 }
 
+/**
+ * Virtual method which indicates whether export should be used
+ * for calculating exphash.
+ * @return `true` if should be used, otherwise `false`.
+ */
+bool Export::isUsedForExphash() const
+{
+	return true;
+}
+
 /**
  * Invalidate ordinal number of export
  *

src/fileformat/types/export_table/export_table.cpp

@@ -4,6 +4,8 @@
  * @copyright (c) 2017 Avast Software, licensed under the MIT license
  */
 
+#include "retdec/crypto/crypto.h"
+#include "retdec/utils/string.h"
 #include "retdec/utils/conversion.h"
 #include "retdec/fileformat/types/export_table/export_table.h"
 
@@ -37,6 +39,33 @@ std::size_t ExportTable::getNumberOfExports() const
 	return exports.size();
 }
 
+/**
+ * Get exphash as CRC32
+ * @return Exphash as CRC32
+ */
+const std::string& ExportTable::getExphashCrc32() const
+{
+	return expHashCrc32;
+}
+
+/**
+ * Get exphash as MD5
+ * @return Exphash as MD5
+ */
+const std::string& ExportTable::getExphashMd5() const
+{
+	return expHashMd5;
+}
+
+/**
+ * Get exphash as SHA256
+ * @return Exphash as SHA256
+ */
+const std::string& ExportTable::getExphashSha256() const
+{
+	return expHashSha256;
+}
+
 /**
  * Get selected export
  * @param exportIndex Index of selected export (indexed from 0)
@@ -101,6 +130,60 @@ ExportTable::exportsIterator ExportTable::end() const
 	return exports.end();
 }
 
+/**
+ * Compute export hashes - CRC32, MD5, SHA256.
+ */
+void ExportTable::computeHashes()
+{
+	std::vector<std::string> funcNames;
+	std::vector<std::uint8_t> expHashBytes;
+
+	for(const auto& newExport : exports)
+	{
+		if(!newExport.isUsedForExphash())
+		{
+			continue;
+		}
+
+		auto funcName = toLower(newExport.getName());
+
+		// convert ordinal to export name
+		if(funcName.empty())
+		{
+			unsigned long long ord;
+			if(newExport.getOrdinalNumber(ord))
+			{
+				funcName = toLower("ord" + std::to_string(ord));
+			}
+		}
+
+		if(!funcName.empty())
+		{
+			funcNames.push_back(funcName);
+		}
+	}
+
+	std::sort(funcNames.begin(), funcNames.end());
+
+	for(const auto& funcName : funcNames)
+	{
+		// Yara adds comma if there are multiple imports
+		if(!expHashBytes.empty())
+		{
+			expHashBytes.push_back(static_cast<unsigned char>(','));
+		}
+
+		for(const auto c : std::string(funcName))
+		{
+			expHashBytes.push_back(static_cast<unsigned char>(c));
+		}
+	}
+
+	expHashCrc32 = retdec::crypto::getCrc32(expHashBytes.data(), expHashBytes.size());
+	expHashMd5 = retdec::crypto::getMd5(expHashBytes.data(), expHashBytes.size());
+	expHashSha256 = retdec::crypto::getSha256(expHashBytes.data(), expHashBytes.size());
+}
+
 /**
  * Delete all records from table
  */

src/fileformat/types/import_table/import_table.cpp

@@ -668,7 +668,7 @@ std::size_t ImportTable::getNumberOfImportsInLibraryCaseInsensitive(const std::s
  * Get imphash as CRC32
  * @return Imphash as CRC32
  */
-std::string ImportTable::getImphashCrc32() const
+const std::string& ImportTable::getImphashCrc32() const
 {
 	return impHashCrc32;
 }
@@ -677,7 +677,7 @@ std::string ImportTable::getImphashCrc32() const
  * Get imphash as MD5
  * @return Imphash as MD5
  */
-std::string ImportTable::getImphashMd5() const
+const std::string& ImportTable::getImphashMd5() const
 {
 	return impHashMd5;
 }
@@ -686,7 +686,7 @@ std::string ImportTable::getImphashMd5() const
  * Get imphash as SHA256
  * @return Imphash as SHA256
  */
-std::string ImportTable::getImphashSha256() const
+const std::string& ImportTable::getImphashSha256() const
 {
 	return impHashSha256;
 }
@@ -826,7 +826,6 @@ void ImportTable::computeHashes()
  */
 void ImportTable::clear()
 {
-	impHashBytes.clear();
 	libraries.clear();
 	imports.clear();
 	impHashCrc32.clear();

src/fileinfo/file_information/file_information.cpp

@@ -943,6 +943,33 @@ std::size_t FileInformation::getNumberOfStoredExports() const
 	return exportTable.getNumberOfExports();
 }
 
+/**
+ * Get exphash as CRC32
+ * @return Exphash as CRC32
+ */
+std::string FileInformation::getExphashCrc32() const
+{
+	return exportTable.getExphashCrc32();
+}
+
+/**
+ * Get exphash as MD5
+ * @return Exphash as MD5
+ */
+std::string FileInformation::getExphashMd5() const
+{
+	return exportTable.getExphashMd5();
+}
+
+/**
+ * Get exphash as SHA256
+ * @return Exphash as SHA256
+ */
+std::string FileInformation::getExphashSha256() const
+{
+	return exportTable.getExphashSha256();
+}
+
 /**
  * Get export name
  * @param position Index of selected export (indexed from 0)

src/fileinfo/file_information/file_information.h

@@ -179,6 +179,9 @@ class FileInformation
 		/// @name Getters of @a exportTable
 		/// @{
 		std::size_t getNumberOfStoredExports() const;
+		std::string getExphashCrc32() const;
+		std::string getExphashMd5() const;
+		std::string getExphashSha256() const;
 		std::string getExportName(std::size_t position) const;
 		std::string getExportAddressStr(std::size_t position, std::ios_base &(* format)(std::ios_base &)) const;
 		std::string getExportOrdinalNumberStr(std::size_t position, std::ios_base &(* format)(std::ios_base &)) const;

src/fileinfo/file_information/file_information_types/export_table.cpp

@@ -34,6 +34,33 @@ std::size_t ExportTable::getNumberOfExports() const
 	return table ? table->getNumberOfExports() : 0;
 }
 
+/**
+ * Get exphash as CRC32
+ * @return Exphash as CRC32
+ */
+std::string ExportTable::getExphashCrc32() const
+{
+	return table ? table->getExphashCrc32() : "";
+}
+
+/**
+ * Get exphash as MD5
+ * @return Exphash as MD5
+ */
+std::string ExportTable::getExphashMd5() const
+{
+	return table ? table->getExphashMd5() : "";
+}
+
+/**
+ * Get exphash as SHA256
+ * @return Exphash as SHA256
+ */
+std::string ExportTable::getExphashSha256() const
+{
+	return table ? table->getExphashSha256() : "";
+}
+
 /**
  * Get export name
  * @param position Index of selected export from table (indexed from 0)

src/fileinfo/file_information/file_information_types/export_table.h

@@ -25,6 +25,9 @@ class ExportTable
 		/// @name Getters
 		/// @{
 		std::size_t getNumberOfExports() const;
+		std::string getExphashCrc32() const;
+		std::string getExphashMd5() const;
+		std::string getExphashSha256() const;
 		std::string getExportName(std::size_t position) const;
 		std::string getExportAddressStr(std::size_t position, std::ios_base &(* format)(std::ios_base &)) const;
 		std::string getExportOrdinalNumberStr(std::size_t position, std::ios_base &(* format)(std::ios_base &)) const;

src/fileinfo/file_presentation/getters/iterative_getter/iterative_distribution_getter/export_table_plain_getter.cpp

@@ -58,7 +58,13 @@ std::size_t ExportTablePlainGetter::getBasicInfo(std::size_t structIndex, std::v
 	info.clear();
 
 	desc.push_back("Number of exports: ");
+	desc.push_back("CRC32            : ");
+	desc.push_back("MD5              : ");
+	desc.push_back("SHA256           : ");
 	info.push_back(numToStr(fileinfo.getNumberOfStoredExports()));
+	info.push_back(fileinfo.getExphashCrc32());
+	info.push_back(fileinfo.getExphashMd5());
+	info.push_back(fileinfo.getExphashSha256());
 
 	return info.size();
 }

src/fileinfo/file_presentation/getters/iterative_getter/iterative_subtitle_getter/export_table_json_getter.cpp

@@ -50,7 +50,13 @@ std::size_t ExportTableJsonGetter::getBasicInfo(std::size_t structIndex, std::ve
 	info.clear();
 
 	desc.push_back("numberOfExports");
+	desc.push_back("crc32");
+	desc.push_back("md5");
+	desc.push_back("sha256");
 	info.push_back(numToStr(fileinfo.getNumberOfStoredExports()));
+	info.push_back(fileinfo.getImphashCrc32());
+	info.push_back(fileinfo.getImphashMd5());
+	info.push_back(fileinfo.getImphashSha256());
 
 	return info.size();
 }